p PatchFirst

CVE-2026-62680

CVE-2026-62680 · Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

CVSS 7.1 · Alta · EPSS 0,4% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • orval

    Versiones
    • < 8.22.0: Afectada

    Sin corrección publicada

  • orval npm

    Intervalos de versiones afectados
    • SEMVER: < 8.22.0

    Actualiza a 8.22.0

Fuentes originales

Comprueba tu servidor →